An industrial SME attempting to integrate a generative AI module into its customer service rarely encounters a technology problem. The blockage comes from uncertainty about data protection, infrastructure costs, and the lack of internal skills to manage the deployment. This observation, shared by a growing number of companies in 2024, illustrates a shift: business trends are no longer just about adopting new tools, but about structuring their governance.
Generative AI Governance: The Real Competitiveness Filter in 2024
There is much talk about generative AI as a productivity lever. On the ground, the question that blocks management committees is not “which tool to choose,” but “how to frame its use without hindering teams.”
Industrial companies now identify deployment costs, infrastructure limitations, data protection, and the lack of skills as the main operational barriers. The problem is no longer strategic buy-in: management wants to proceed. It is the concrete conditions for production that slow things down.
Trust in automated decisions remains the central challenge. When an algorithm proposes a customer response or a pricing adjustment, who validates it? Who bears responsibility in case of an error? Without a clear answer, teams circumvent the tool or use it partially, negating the expected gain.
For those following economic and technological news, one can discover Net Actu for business and gauge how much these governance issues are overshadowing product announcements.
The concrete action point: before deploying a generative AI tool, map the data it consumes, define a human validation circuit, and train at least one person per department in interpreting the results. Without this foundation, the tool becomes a risk rather than an advantage.
European Digital Compliance: AI Act, NIS2, and DORA as Supplier Selection Criteria
The European regulation on AI (AI Act), published in 2024, imposes a classification of systems by risk level. At the same time, NIS2 extends the common cybersecurity framework to 18 critical sectors. In finance, DORA has been applicable since January 17, 2025.
This regulatory overlay transforms supplier selection. A cloud provider or software publisher that cannot document its compliance with these frameworks loses tenders, regardless of the quality of its product.
In practice, companies must audit their existing contracts, require incident management clauses, and verify the security documentation of each third party. This work, once confined to IT departments, now involves purchasing, legal, and sales departments.
What This Means for a Mid-Sized Company
An intermediate-sized enterprise selling digital solutions to clients in health or energy must prove its NIS2 compliance to retain its markets. Feedback varies on the actual burden of compliance, but the signal is clear: digital compliance is a sales argument, not an administrative cost.
- Document data processing processes for each solution sold or used, specifying cross-border flows
- Integrate a cybersecurity component into supplier contracts, with audit and incident notification obligations
- Train sales teams to present compliance as a differentiator when responding to tenders
Supply Chain Cybersecurity: A Direct Business Risk
A security incident at a logistics subcontractor or a SaaS provider does not remain confined to IT. It causes delivery delays, customer service disruptions, and sometimes contractual penalties.
Cloud and managed service providers are audited by their own clients on their ability to manage incidents and secure access to data. NIS2 accelerates this movement by making the responsibility extended to third parties explicit.
For a general management team, the change in posture is clear: supply chain cybersecurity is no longer a technical issue delegated to the CISO. It is a business continuity issue that rises to the management committee.
Priority Actions for Suppliers and Clients
- Map critical digital dependencies (hosting, payment, logistics, CRM) and assess the security maturity of each provider
- Establish continuity plans that include the failure of a digital provider, not just a physical one
- Include accelerated termination clauses in case of security non-compliance identified during an audit
Leadership and Hybrid Skills: What the Market Expects from Teams in 2024
Job offers in digital, marketing, and customer relationship management increasingly mention cross-functional skills. Companies are looking for a marketing manager who understands GDPR constraints, a salesperson capable of communicating with a data team, and a logistics project manager who can read a vulnerability report.
Leadership in 2024 is measured by the ability to make technical and business profiles work together. Companies that still silo their departments (IT on one side, sales on the other) lose responsiveness to new regulatory demands and consumer expectations.
The content of training is also evolving. Successful internal programs combine short modules on AI, cybersecurity, and compliance, accessible to non-specialists. The goal is not to turn every employee into an expert, but to create a common understanding base that accelerates decision-making.
Companies that stand out in 2024 are not those that accumulate digital solutions. They are the ones that structure the governance of these solutions, align their teams with new regulatory constraints, and treat cybersecurity as a commercial lever. The rest is just tooling.
